This study guide provides a structured review of the core concepts, tools, and workflows required for the Microsoft Certified GitHub Foundations (GH-900) certification. It is based on foundational principles of version control, collaborative development, and AI-powered workflows as implemented on the GitHub platform.
Part 1: Knowledge Review Quiz
Instructions: Answer the following questions in two to three sentences, ensuring that your responses are based on the provided source context.
- What is the primary difference between Git and GitHub?
- How should the branches be configured when a developer wants to merge a completed feature into the main line of development?
- What is the purpose of a "Template Repository," and how does it differ from a "Fork"?
- Define the roles of a "Workflow," a "Job," and a "Runner" within GitHub Actions.
- How does "Secret Scanning" protect a repository, and what is the first step a maintainer should take if a secret is detected?
- Explain the functionality of "GitHub Copilot Agent Mode" compared to standard inline suggestions.
- What is a "Dev Container Configuration," and why is it beneficial for teams using GitHub Codespaces?
- What is "InnerSource," and how does it benefit an organization?
- How do "Branch Protection Rules" ensure code quality and governance in a repository?
- Describe the advantage of Git being a "Distributed Version Control System" for developers without a constant network connection.
Want to see even more questions? Try our 650 exam-style questions eBook at https://cloudcertificationstore.com/b/dCYEI
Part 2: Quiz Answer Key
- Git vs. GitHub: Git is a distributed version control system that manages version history and commits locally. GitHub is a platform that hosts Git repositories and adds collaboration features such as pull requests, issues, and automation tools like GitHub Actions and Projects.
- Pull Request Branch Configuration: In a pull request, the "Base" branch is the destination that receives the changes (e.g., main), while the "Compare" branch contains the new code being submitted for review (e.g., feature-branch). This ensures that the review process clearly shows the differences between the new work and the existing stable code.
- Template Repositories vs. Forks: A template repository provides a starting structure for new projects without inheriting the original's commit history, ensuring a clean slate. A fork creates a linked copy that preserves the full history and relationship with the upstream repository, typically for contributing changes back to the original project.
- Actions Components: A "Workflow" is the YAML-defined automation triggered by events, which contains one or more "Jobs." A job is a group of steps that run together on a "Runner," which is the specific machine or environment providing the compute power for execution.
- Secret Scanning and Remediation: Secret scanning identifies exposed credentials or tokens in the repository’s history and can prevent them from being pushed via push protection. If a secret is detected, the maintainer should immediately revoke or rotate the credential, as it must be treated as compromised even if the code is later deleted.
- Copilot Agent Mode: Unlike inline suggestions that generate code at the cursor, Agent Mode is designed for autonomous, multi-step tasks. It can independently plan and execute changes across multiple files and use development tools, though results still require human validation.
- Dev Container Configuration: This configuration defines the tools, extensions, and runtimes needed for a project within a codespace. It ensures that every team member works in a consistent environment, reducing onboarding time and "it works on my machine" discrepancies.
- InnerSource: InnerSource is the practice of applying open-source collaboration methods—such as transparent contributions and cross-team code sharing—within the private boundaries of an organization. It helps reduce silos, encourages code reuse, and improves overall engineering quality across internal teams.
- Branch Protection: These rules enforce requirements such as mandatory pull request approvals, signed commits, or passing automated status checks before code can be merged. This prevents unreviewed or broken code from reaching critical branches like main.
- Distributed Version Control: Because every clone of a Git repository contains the full project history locally, developers can commit, branch, and view history without a network connection. Synchronization with a remote server like GitHub is only required when the developer is ready to share or retrieve updates.
Part 3: Essay Format Questions
Instructions: These questions are designed to test your ability to synthesize information and explain complex GitHub workflows. No answers are provided for this section.
- The Software Development Lifecycle (SDLC) and Automation: Discuss how GitHub Actions facilitates Continuous Integration and Continuous Deployment (CI/CD). In your answer, explain how triggers, jobs, and environments work together to ensure code is built, tested, and deployed securely.
- Documentation Strategies in GitHub: Compare and contrast the use of README.md, GitHub Wikis, and GitHub Pages. Under what specific circumstances should a project team choose one of these methods over the others for documenting their software?
- The Role of AI in the Developer Workflow: Analyze how GitHub Copilot and GitHub Codespaces together transform the traditional development environment. How do these tools address productivity, and what responsibilities remain with the human developer regarding security and validation?
- Project Management and Visibility: Explain the various ways GitHub allows teams to organize work, including the use of Issues (parent/sub-issue relationships), Milestones, Labels, and GitHub Projects. How do these tools contribute to tracking progress toward a major release like "Version 3.0"?
- Securing the Software Supply Chain: Evaluate the suite of security features available on GitHub, including Dependabot, Code Scanning, and Dependency Review. How do these tools collectively help a maintainer identify and remediate vulnerabilities introduced by third-party packages?
Part 4: Glossary of Key Terms
Branch
An independent line of development within a repository that allows users to work on features or fixes without affecting the main code.
CODEOWNERS
A file that maps specific repository paths to individuals or teams who are automatically requested to review pull requests affecting those files.
Commit
A snapshot of changes saved to the repository history, including metadata like the author, timestamp, and a descriptive message.
CONTRIBUTING.md
A file that provides instructions on how community members should participate in a project, covering coding standards and PR expectations.
Dependabot
A security tool that identifies vulnerable dependencies, alerts maintainers, and can automatically open pull requests to update to safer versions.
Enterprise Managed Users (EMU)
An identity model where user accounts are provisioned, suspended, and centrally controlled by an enterprise via an identity provider.
Fork
A copy of a repository that remains related to the original "upstream" source, allowing for independent experimentation and contribution back to the original.
Gist
A lightweight way to share code snippets, notes, or small collections of files without creating a full project repository.
GitHub Actions
An automation platform that allows users to create workflows triggered by repository events, such as pushes or pull requests.
GitHub Codespaces
A cloud-hosted development environment that provides a preconfigured virtual machine, editor access, and terminal for a repository.
GitHub Copilot
An AI-powered assistant that provides code suggestions, explains logic, and helps complete programming tasks within a developer's editor.
GitHub Flow
A lightweight, branch-based workflow where all feature development happens on short-lived branches before being merged into the default branch via pull requests.
GitHub Pages
A hosting service that publishes static websites directly from a repository's content (e.g., from the /docs folder).
Git Tag
A stable, named reference to a specific commit, commonly used to mark release versions like v2.0.0.
Issue
A trackable item used to report bugs, suggest features, or manage tasks within a repository.
LICENSE
A file that defines the legal permissions and restrictions for using, modifying, and distributing the project's code.
Milestone
A feature used to group issues and pull requests toward a specific goal or deadline, tracking progress through a percentage completion bar.
Pull Request (PR)
A formal proposal to merge changes from one branch (compare) into another (base), providing a forum for review and automated testing.
Repository
The most basic element of GitHub, containing all project files and their entire revision history.
Runner
A machine that executes the jobs defined in a GitHub Actions workflow; can be GitHub-hosted or self-hosted.
SECURITY.md
A file containing a project's security policy, instructions for reporting vulnerabilities, and supported versions for security updates.
Squash and Merge
A merge method that combines all commits from a pull request into a single commit on the base branch for a cleaner history.
Staging Area
A middle ground in Git where changes are gathered and prepared before being recorded in a commit.
Workflow Trigger
A specific event (like push, pull_request, or a schedule) that causes a GitHub Actions workflow to start.
Are you ready to take the exam? Want to see even more questions? Try our 650 exam-style questions eBook at https://cloudcertificationstore.com/b/dCYEI